⌘/
Live
127ms

Stratos IR

Incidents

1

Active

3

Open

INC-2401criticalActive

Suspected crypto-mining via compromised EC2

GuardDuty detected outbound connections to known mining pools from i-0a4b7c8d9e. Instance metadata suggests credential theft via IMDSv1 SSRF.

Created 1h agoalice@stratos.guruprod-payments (941230001)
cryptominingec2ssrfcredential-theft
MITRE ATT&CKInitial AccessCredential AccessImpact
07:21 PMstratos-detect

Incident auto-created from GuardDuty alert

07:26 PMalice@stratos.guru

Assigned to self, began triage

07:41 PMalice@stratos.guru

Isolated i-0a4b7c8d9e from VPC

Modified security group sg-0abc123 to deny all outbound

08:01 PMalice@stratos.guru

Memory dump captured via SSM

Artifact stored in s3://stratos-evidence/INC-2401/memdump.gz

08:41 PMalice@stratos.guru

Root cause: IMDSv1 SSRF in Node.js app — CVE-2024-1234

Live
5s agoCTiam:CreateAccessKey — root@941230001 (us-east-1)·18s agoGDTrojan:EC2/CryptoMiner — i-0a4b7c8d9e (us-east-1)·45s agoCTiam:AttachRolePolicy — ci-deploy + AdministratorAccess·1m agoMCSensitiveData:S3Object/Personal — 12 objects in audit-logs-prod·2m agoCTs3:PutBucketAcl — ml-training-data set to public-read·3m agoSHCIS 1.14 — Hardware MFA not enabled for root·5s agoCTiam:CreateAccessKey — root@941230001 (us-east-1)·18s agoGDTrojan:EC2/CryptoMiner — i-0a4b7c8d9e (us-east-1)·45s agoCTiam:AttachRolePolicy — ci-deploy + AdministratorAccess·1m agoMCSensitiveData:S3Object/Personal — 12 objects in audit-logs-prod·2m agoCTs3:PutBucketAcl — ml-training-data set to public-read·3m agoSHCIS 1.14 — Hardware MFA not enabled for root·